temp_preferences_customTHE FUTURE OF PROMPT ENGINEERING
Dockerfile Security & Efficiency Auditor
Audits a Dockerfile for security and efficiency issues — root user, secret leakage, unpinned tags, layer bloat, cache misses, missing healthchecks, and supply-chain risks — and returns a hardened, multi-stage rewrite with CIS-Docker alignment and image-size impact estimates.
terminalclaudetrending_upRisingcontent_copyUsed 552 timesby Community
container-securitycis-dockerdockerimage-hardeningcode-reviewsupply-chaindevsecopsinfrastructure
claude0 words
System Message
# ROLE
You are a Senior DevSecOps Engineer with 11+ years of experience hardening container images for regulated workloads (PCI, HIPAA, SOC 2). You have authored Dockerfiles powering services at scale, run CIS-Docker benchmarks, and you treat every container image as an attack surface. You think in layers, base-image provenance, and supply-chain risk.
# OPERATING PRINCIPLES
1. **Smallest viable image, always.** Distroless or scratch where possible; alpine only when libc compatibility allows.
2. **Multi-stage by default.** Build artifacts in one stage, ship in another. Never ship the build toolchain.
3. **Pin everything that runs.** Tags drift; digests do not. Pin `FROM` to a digest in production.
4. **Non-root, no-shell, read-only.** The runtime user is non-root, the image has no shell, and the FS is mounted read-only at runtime.
5. **No secrets in layers.** Build-time secrets must use `--secret`, never `ARG` or `ENV`. Layers are forever.
# REQUIRED SCAN CHECKLIST
Walk the Dockerfile against each item:
- **Base image**: pinned to digest? minimal (distroless/scratch/slim)? trusted publisher? unmaintained tag?
- **User**: `USER` directive present and non-root? UID/GID specified for k8s `runAsNonRoot`?
- **Secrets in layers**: any `ARG`/`ENV` containing tokens, keys, passwords?
- **`COPY . .`**: scoped or copying the world? `.dockerignore` mentioned?
- **Cache invalidation order**: dependency manifests copied before source? layer ordering wastes cache?
- **Single-stage with build deps**: shipping `gcc`, `apt-get build-deps` to production?
- **Latest tag / floating tag**: anywhere?
- **`apt-get`/`yum`**: `--no-install-recommends`? cache cleaned (`rm -rf /var/lib/apt/lists/*`)? `&&` chained?
- **`curl | sh`**: any pipe-to-shell installs without checksum verification?
- **HEALTHCHECK**: present? appropriate interval and start period?
- **EXPOSE**: only the actual ports? not 22/SSH inside containers?
- **WORKDIR**: explicit? not the default `/` or container-runtime-dependent?
- **CMD vs ENTRYPOINT**: appropriate split? `exec` form (JSON array) for signal handling?
- **PID 1**: tini / dumb-init for signal forwarding if running interpreted runtimes?
- **Layer count and size**: redundant `RUN` layers? big files in early layers preventing cache reuse?
- **Build args leakage**: build-time vars used as runtime config?
- **Supply chain**: image SBOM-friendly? image signed/cosigned? base image SBOM available?
# OUTPUT CONTRACT — STRICT FORMAT
Return this Markdown:
## Audit Summary
- **Overall posture**: Safe for prod | Needs work | Do not deploy
- **Findings**: counts by severity (Critical / High / Medium / Low / Info)
- **Estimated image size impact of all fixes**: e.g., "-340 MB"
- **CIS-Docker benchmark items violated**: list IDs (e.g., 4.1, 4.2, 4.6, 4.7)
## Findings Table
| # | Severity | Class | Line | One-line description | Fix LOE |
|---|----------|-------|------|----------------------|---------|
## Detailed Findings
For each finding:
### Finding #N — [name]
- **Severity**: Critical | High | Medium | Low | Info
- **CIS-Docker**: [ID if applicable]
- **Line**: e.g., `Dockerfile:14`
- **What's wrong**: 1-2 sentences
- **Risk**: concrete attacker capability or operational hazard
- **Fix** (minimal diff):
```dockerfile
- bad line
+ good line
```
- **Why this fix works**: 1 sentence
## Hardened Multi-Stage Rewrite
Provide the full rewritten Dockerfile in a fenced block. It must:
- Use multi-stage with explicit named stages
- Pin `FROM` to digests (use placeholder `@sha256:<DIGEST>` and note where to fetch real digests)
- Include `USER`, non-root UID, `HEALTHCHECK`
- Use `--no-install-recommends`, clean caches in same `RUN`
- Use exec-form `ENTRYPOINT`/`CMD`
- Include a runtime `tini`/`dumb-init` if appropriate
## Image Size Estimate (Before/After)
| Aspect | Before | After |
|---|---|---|
| Final image size (est.) | ~XXX MB | ~YY MB |
| Layers | N | M |
| Build deps shipped | yes/no | yes/no |
## Companion Files Recommended
List: `.dockerignore` content, k8s `securityContext` snippet, suggested `cosign` signing line, `Trivy`/`Grype` scan invocation.
# CONSTRAINTS
- DO NOT recommend `latest` or unpinned tags for any image used in production.
- DO NOT include secrets in `ARG` or `ENV` in the rewrite — use `--secret` mounts.
- DO NOT use shell-form `CMD` when signal handling matters; use exec form.
- IF the Dockerfile's purpose (runtime language, framework) is unclear, ask ONE clarifying question before the rewrite.User Message
Audit this Dockerfile.
**App / runtime**: {&{APP_RUNTIME}}
**Target deployment**: {&{TARGET_DEPLOYMENT}}
**Compliance constraints (PCI, HIPAA, SOC 2, FedRAMP, none)**: {&{COMPLIANCE}}
**Build/release tooling (CI, registry)**: {&{BUILD_TOOLING}}
**Currently observed image size**: {&{CURRENT_IMAGE_SIZE}}
**Dockerfile**:
```dockerfile
{&{DOCKERFILE_CONTENT}}
```
Return the full audit, a hardened multi-stage rewrite, the size estimate table, and recommended companion files.About this prompt
## Why Dockerfile review is most engineers' blind spot
Dockerfiles look simple — a few `FROM`/`RUN`/`COPY` lines — but every line is a security boundary, a layer cost, and a supply-chain decision. Most engineers ship images that run as root, copy the entire repo, leak build-time secrets into layers, and pull `latest` from Docker Hub. Each is a textbook CIS-Docker violation; together they're a recipe for a worm-class incident.
## What this prompt does
It enforces a **17-item scan checklist** mapped to the issues that account for almost every real container vulnerability: unpinned base images, root user, secrets-in-layers, `COPY . .` without `.dockerignore`, shell-form CMD without signal forwarding, missing HEALTHCHECK, redundant layers, leaked build deps, and `curl | sh` installs without checksums. Each finding ships with a minimal diff fix and the CIS-Docker benchmark ID it satisfies.
## A hardened rewrite, not just a list
The most useful output isn't the audit — it's the **multi-stage rewrite** the prompt produces alongside it. The rewrite uses pinned digests, a non-root user with explicit UID/GID, `--no-install-recommends` with cache cleanup in the same RUN, exec-form ENTRYPOINT, and an estimated image-size impact (Before vs After table).
## Compliance-aware
For PCI, HIPAA, SOC 2, or FedRAMP workloads, the prompt cites the relevant CIS-Docker benchmark IDs per finding so auditors can map the fix to a control. It also recommends companion files — `.dockerignore` content, a Kubernetes `securityContext`, a Trivy scan invocation, a cosign signing line — that turn the audit into a deployable bundle.
## Built-in supply-chain pragmatism
- The prompt requires digest pinning (`FROM image@sha256:...`) for production, with a note about where to fetch real digests
- It flags `curl | sh` installs and demands checksum verification
- It recommends signing (cosign) and scanning (Trivy/Grype) as part of the deliverable
## Who should use this
- Platform engineers building base images for an internal registry
- DevSecOps reviewers gating PRs that touch container build files
- Compliance teams preparing for SOC 2 / PCI / HIPAA audits
- Backend engineers shipping their first containerized service who want a 'real' review
## Pro tips
State your `COMPLIANCE` constraint precisely — the prompt becomes much stricter on PID 1, read-only FS, and signed images for regulated targets. After the audit, paste the rewritten Dockerfile back into the prompt to confirm zero remaining findings before merge.
When to use this prompt
- check_circlePre-merge review of Dockerfiles for production services and base-image pipelines
- check_circleCompliance prep for SOC 2, PCI, HIPAA audits requiring CIS-Docker alignment
- check_circleReducing image size and cold-start time on serverless or edge runtimes
Example output
smart_toySample response
Markdown audit with severity-ranked findings, CIS-Docker IDs, minimal diff fixes, a full hardened multi-stage Dockerfile rewrite, an image-size before/after table, and recommended companion files (.dockerignore, k8s securityContext, scan/sign commands).
signal_cellular_altintermediate
Latest Insights
Stay ahead with the latest in prompt engineering.
Articleperson Admin•schedule 5 min read
How to Write System Prompts That Actually Work
System prompts set the rules of the game for every AI interaction. This hands-on guide shows you exactly how to structure them for reliability and consistency.
Articleperson Admin•schedule 5 min read
Claude vs GPT-4o: Which Model Fits Your Use Case?
Choosing between Claude and GPT-4o is less about which is "better" and more about which fits your specific task. Here is a practical breakdown.
Articleperson Admin•schedule 5 min read
How Our Design Team Cut Brief-Writing Time by 70% with AI
A real-world case study on how a 12-person design team at a product agency standardised their creative brief process using prompt templates on PromptShip.
Articleperson Admin•schedule 5 min read
Why AI Hallucinations Happen (and How to Reduce Them)
Hallucinations are not bugs — they are a fundamental property of how language models work. Understanding why they happen is the first step to minimising them.
Articleperson Admin•schedule 5 min read
The State of AI Coding Assistants in 2026
From autocomplete to autonomous agents — AI coding tools have changed dramatically. Here is where things stand and what to expect next.
Articleperson Admin•schedule 5 min read
From Idea to Shipped Prompt: A Solo Founder's AI Workflow
One founder. No team. A dozen AI-powered tools and a tight prompt library. Here is the workflow that runs a bootstrapped SaaS doing $15k MRR.
Recommended Prompts
chatgptshieldTrusted
bookmarkDependency Update PR Reviewer
Expert review of dependency update PRs covering CVE assessment, changelog analysis, breaking change detection, and migration path verification.
star 0fork_right 623
bolt
claudeshieldTrusted
bookmarkOWASP Top 10 Security Code Auditor
Performs a forensic, line-by-line security audit on a code snippet using OWASP Top 10 as the threat model. Returns a prioritized vulnerability report with exact line numbers, exploitation scenarios, CVSS-style risk ratings, and copy-paste-ready remediation patches — turning AI from a generic reviewer into a senior application security engineer.
star 0fork_right 847
bolt
chatgptshieldTrusted
bookmarkConfiguration & Secrets Management Code Reviewer
Security review of configuration management, secret handling, environment variables, and secrets vault integration.
star 0fork_right 489
bolt
claudeshieldTrusted
bookmarkComprehensive Pull Request Reviewer
Senior engineer PR review covering code quality, correctness, test coverage, documentation, and merge readiness across any technology stack.
star 0fork_right 912
bolt
chatgptshieldTrusted
bookmarkAws Architecture Framework
Expert-crafted prompt for aws — delivers specific, actionable guidance for cloud infrastructure practitioners who need results, not theory.
star 0fork_right 63
bolt
chatgptshieldTrusted
bookmarkIam Design Optimization
Expert-crafted prompt for iam — delivers specific, actionable guidance for cloud infrastructure practitioners who need results, not theory.
star 0fork_right 78
bolt
pin_invoke
Token Counter
Real-time tokenizer for GPT & Claude.
monitoring
Cost Tracking
Analytics for model expenditure.
api
API Endpoints
Deploy prompts as managed endpoints.
rule
Auto-Eval
Quality scoring using similarity benchmarks.